The DMZ

Henry WH Hack

08:12

all by myself

Lighty

Morning

Henry WH Hack

@Lighty moring

TildalWave

@Adi either case, it's gonna be Hilarious :)) (see what I did there?)

Henry WH Hack

@TildalWave sorry

Lighty

@Adi ohyeah, any resulsts yet on yesterday?

M'vy

08:20

hi

Henry WH Hack

@M'vy hi

AviD

Colin Cassidy

Mornin'

Henry WH Hack

@ColinCassidy morning

AviD

08:36

hahahaha Meta.sec.se is funny today

0

Q: Why were my -1s turned into +1s?

I ran into a user that has a swath of poorly thought out, poorly written, not relevant, and often just plain wrong answers (it appears this person has a very limited understanding of information security and chooses to answer many advanced questions). I went through all of their answers and gave ...

1

Q: Retaliatory down-vote of all my questions. Are there repercussions for the user?

I only noticed this had occurred because the system detected it, and restored my points. However I'm wondering if this triggers some kind of account restrictions for the offending user. Retaliatory down-voting is extremely detrimental to any forum, so I would hope there is some way for it to act...

discussion down-votes

Henry WH Hack

@AviD Why I was blocked?

AviD

@HenryWHHack uncouth behaviour.

numerous warnings.

Henry WH Hack

wait I was warned

AviD

exactly.

TildalWave

@AviD mind that it might also have been targeted votes reversal, OP does mention about 3/4 of their [specific person] answers

AviD

08:39

@TildalWave which OP

and yeah, it looks like those 2 q's are about the same incident, from opposite sides

TildalWave

@AviD the one from the question I replied to... you want coffee dear?

Henry WH Hack

BTW It was msdos

AviD

yes I know, that's what I'm saying

TildalWave

just tell @schroeder how to check for vote reversal, he's on it

if you don't know, ask me :P

or ... I can flag something and 200 other mods can tell you :))

AviD

oh I know

TildalWave

08:43

what's the point of TL anyway, if you can move TL wherever their abuse is least needed with a single click? :P

AviD

I just found that juxtaposition of meta q's to be hilariously fortuitous.

Rоry McCune

mornin' all

TildalWave

@AviD oh agreed, but there's a way to check if they're correlated, and you said "it looks like" they might be

Henry WH Hack

@everyoneinthiscatroom Sorry I was a complete idiot before!

AviD

@TildalWave well, as a mod of course I cannot reveal personal information. Especially if I was too lazy to check before commenting on it.

TildalWave

08:45

@AviD then say that... JEEZOOS!!

AviD

actually I am reviewing his answers now to see if creme is right

M'vy

@HenryWHHack cat room ?

AviD

@HenryWHHack no apology necessary. just stop being one.

TildalWave

don't make up phony reasons not to disclose some info

AviD

@TildalWave nah, not phony.

besides all the information is right there, dont need to be a mod to discover it (just to verify the obvious).

instead of crankyranting, why dont you go look at some if his answers too?

TildalWave

08:48

@AviD it nearly made you look incompetent, phony is a good choice of a bad word for it and much better than an bad choice of a good word for it I could have opted for instead :P

AviD

@TildalWave wut, not at all

I think you''ve been OD'ing on your angryjuice again today.

TildalWave

wot? LOL dude not at all

Lighty

@AviD Do you talk to your children like that if they throw a tantrum?

Rоry McCune

@BobEbert I'd say that the answer is that you use banner grabbing as part of detecting the service version, they're not alternatives but one is a technique you use in determining the other...

@Adi morning herder

TildalWave

@AviD no need to be so insecure to consider each thing you don't understand as aggressive :P

AviD

08:50

@Lighty are you saying I should treat @TildalWave like an emotional, immature 5 year old?

cuz I have more respect for @TildalWave than that.

actually I dont treat my 5 year old like that either :-)

Henry WH Hack

wait how to become a diamond guy Moderator?

TildalWave

no need for any treatment either, geez you all what's wrong with you?

Lighty

@AviD no, not saying you should, because that would be either mine or @Simon's job, but it kinda sounded like that

AviD

@TildalWave no need to consider each thing you would do differently as something I dont understand.

M'vy

@HenryWHHack election

AviD

08:51

not sure which part you think I missed here.

Lighty

@HenryWHHack Make a sacrifice to the Ursine Overlord

AviD

@TildalWave your vision is being clouded by your emotions.

Rоry McCune

@M'vy you realise you're just improving his algorithm

AviD

too much legitimate frustration, it is spilling over to unrelated areas, I think.

TildalWave

@AviD what emotions?

Lighty

08:52

And now you sound like Yoda @AviD!

M'vy

@RоryMcCune heh? what?

Rоry McCune

@M'vy Mr Whack is (in my opinion) a bot

TildalWave

please stop with this psychoanalysis bullshit

you don't get it

M'vy

@RоryMcCune hm

AviD

@TildalWave dude. you flew off and ranted at me because I didnt tell you if I verified the vote patterns. You need a break.

and you know I say that lovingly.

TildalWave

08:53

what I said was supposed to be a joke, a humorous observation and a play on words

Rоry McCune

@M'vy look at his statements and you'll see there's no actual conversation, it's <single statement> <someone responds> <no reply> <next single statement>

AviD

@TildalWave oh. well then it was funny :-)

@TildalWave which one?

@RоryMcCune same with @Simon.

M'vy

did not bactracked to be honest

Arperum

Morning

TildalWave

@AviD the one you replied to in self-defense when you weren't even attacked

Rоry McCune

08:55

@AviD ...no

AviD

@TildalWave now I am confused - I did not selfdefense at all today

yet

@RоryMcCune whales?

TildalWave

6 mins ago, by AviD

I think you''ve been OD'ing on your angryjuice again today.

AviD

@TildalWave ah thats not selfdefense, thats friendly mocking.

Lighty

@AviD Indeed, no-one got banned yet

AviD

@Lighty wut

Lighty

08:56

@AviD wut

Adi

2 hours ago, by Adi

On a different news, Trump won the majority of states' primaries yesterday. Yay!

TildalWave

@AviD yeah well you owe me a pint of beer then because that's how I like to take friendly mocking

Adi

@RоryMcCune Mewrning!

AviD

@TildalWave fair enough!

Rоry McCune

@Adi have you dropped off FB BTW?

AviD

09:00

though I should point out that if you drink all the pints I already owe you at once, you may get alcohol poisoning... :P

TildalWave

you can mock me all you want if you're buying

AviD

hey considering making it to Rome for AppSecEU?

@TildalWave we have a deal!

@Adi Some men just want to watch the world burn.

Lighty

@Adi really?

incoming shittalk about how the majority of 'muricans are a pair of tits

TildalWave

@AviD I wanna see Putin Trump meet

Matthew

????

0

Q: Where can I find the cache file about onion address?

I'm perparing for my graduation project.It is about Tor hidden services.I configure my machine as directory so that it can obtain onion address of hidden services.I have been studying the basic principle of the Tor, but I still don't understand how to get onion address.But I trust there must be a...

tor

????

M'vy

09:06

vtc

TildalWave

he wants directions to the gates of dark web

AviD

@TildalWave theres an area51 for that

M'vy

Can I Haz Dark Webz ?!

Matthew

What is a cache file of onion addresses? Why would a cache file contain onion addresses?

Lighty

I bet Putin asked that question

Adi

09:10

@RоryMcCune Yeah, a bit more than a month ago

Matthew

Can I run an onion site on an actual onion, powered by a potato?

Rоry McCune

@Adi ahh, I was going to ask you about your bot herding :)

Adi

@Matthew RaspberryPi + fastcompany.com/1311755/how-make-electricity-waste-onion-juice

The closest you can get

TildalWave

@Matthew I think he wanted to ask about a directory like DMOZ but for deep web

makeuseof.com/tag/find-active-onion-sites

Adi

@RоryMcCune I think I'll be back on FB very soon. I usually drop on February

Rоry McCune

09:12

@Adi social media break?

Matthew

@Adi Impressive!

Adi

@RоryMcCune Yeah, something like that

TildalWave

wait, you made a fakebook on Facebook? or did I get that "bot herding" wrong?

Rory Alsop

Guys... What happened yesterday?

I step away to handle an incident and when I come back the transcript is crazy :-)

AviD

@RoryAlsop drama blama

@RoryAlsop totally

Rory Alsop

09:22

Anything I need to know?

AviD

I had the misfortune to be in the middle of mocking @Simon, as one does

Rоry McCune

@RoryAlsop oh thank god the good mod is back, see what happens when you leave @AviD in charge!

5

AviD

@RoryAlsop nah. Some choice stars in TL if youre interested.

Rоry McCune

@RoryAlsop yeah @AviD is bad at handling flags

Rory Alsop

Lol

Ahh - yes. Reading TL now

AviD

09:23

@RoryAlsop but for amusement, take a look at the 2 recent meta posts.

Adi

I received an email that had this line

How the hell do you type that?

Rоry McCune

@RoryAlsop we have a new friend in room who I think is a bot, who posted an e-mail address and said he was going to post its password which caused some flags which @AviD was too slow on so we got a mod-flood, we had cooking mods and all sorts

Adi

(the person is non-technical)

AviD

@RоryMcCune too slow to dismiss

Adi

> we¹ll get back

Is there a simple (non-Alt) key combination to get that?

AviD

09:24

@Adi in Word you can do a footnote

dont know the key combination

TildalWave

@RoryAlsop TL;DR - someone here behaves like a bot and becomes slightly obnoxious, I flag one of the last replies, hordes flock in, someone started flagging many other posts of probably same user, things got awkward, mob took off, things got unawkward, voila... much wow

AviD

@TildalWave nice summation

Adi

@AviD Any easy way to accidentally do it in Outlook?

Rory Alsop

Wheeeeee

AviD

@Adi dunno

Rory Alsop

09:25

It does highlight the flaws we know about in the current flag handling system for chat

AviD

I'm not seeing it anywhere

TildalWave

where is that pinned post that asked external mods to not crap up the place?

AviD

@RoryAlsop indeed

TildalWave

ah it's in the description now

AviD

I'm guessing it was unpinned

its always been in the description

TildalWave

09:28

no, it was a pined massage, it has been mowed to decryption later

AviD

it was a pinned mesage from yesterday, but the description had that for a long time.

I think @RоryMcCune put it in after the previous modflood.

Rоry McCune

yeah that chat's been in the description for aaages

TildalWave

I confused it with addition of non-support and the PS

HamZa

Morning

Any one interested in Boston Key Party CTF 2016?

TildalWave

@HamZa start a thread on Information Security Meta, maybe people turn up

HamZa

09:36

@TildalWave I thought before starting an official thread lets ask unofficially here :P

TildalWave

sure

I probably won't be able to

Lighty

0

Q: Evaluate the substance in GhostMail's encryption

GhostMail is another secure email service that opened for business rather recently. I was wondering if someone more qualified than me would take a look at GhostMail for potential weaknesses. They explain their encryption in more depth here. They seem to have had an audit too (note: this link is a...

encryption privacy email

This question feels as if it's not a good one/not allwoed etc.

but cant put my finger on it, is it even a wrong question?

Adi

@HamZa My company is participating

HamZa

wow, a company participating. That's a first for me :- )
Are you going to participate?

Adi

Yep

HamZa

09:39

Cool~

Matthew

@Lighty Looks like a "redo this audit" type question, which is tricky since the audit link appears broken...

HamZa

@Matthew or break this system for me will ya :P

TildalWave

@Matthew it's not broken but it's hardly a comprehensive audit, it reads more as an endorsement

@Lighty I VTC'ed as unclear, we're not free auditing service ... if he can whip up a more specific question then fine, otherwise not

Matthew

@TildalWave Oh, it's not loading for me...

Lighty

10:00

@TildalWave hmm, shoudlnt there be a flag for these kind of things?

M'vy

I VtC too broad (requires extensive answer)

Lighty

I'm pretty sure the scope explains that such "audit" questions arent really, eh, our thing

HamZa

@Lighty "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem."

Lighty

@HamZa well, testing and breaking are two different things, unless you specifically ask for Pentesting, wich he doesn't, right?

Colin Cassidy

just two minutes messing about with Burpsuite's Intruder module, and googles 'I Feel Lucky' functionality I've just messed up the new UK spying bill :) Feel free to retain my internet records, good luck weeding out the real from the chaff :D

Rоry McCune

10:15

@ColinCassidy lolz

Matthew

@ColinCassidy I think that falls under the "ah, you have something to hide, meet my friend my waterboard" section

Colin Cassidy

oh no sir not me, I've not hidden anything, see it's all there plain as day... I blame malware

though now I have to worry about where 'feeling lucky' is going to send me...

Stu W

start a campaign to get everyone to run tor exit nodes?

as good luck dealing with all the metadata from that :p

Rоry McCune

10:31

@AviD speaker list is up for AppSecEU 2016.appsec.eu/?page_id=43

AviD

@RоryMcCune I'm not on it

no docker talks

Rоry McCune

@AviD me neither... they've got a secdevops talk and one really odd sounding one about containers, but no docker specifically

I literally don't know what a talk called "Attack tree vignettes for Containers as a Service applications and risk centric threat models" is going to be about

AviD

I gotta say, some of these talks were obviously selected because the speaker is a celebrity (or possibly worse). The topics are non-content.

@RоryMcCune heh wat

@RоryMcCune probably translated from german

Rоry McCune

@AviD yeah there's a load of well known american speakers in there...

AviD

@RоryMcCune I mean, not just that - but a goddamn talk on how to use goddamn jira?? really??

Rоry McCune

10:34

@AviD heh, nah it's Tony Ucedavelez (I think they've mispelt his surname) who IIRC is US'ian

AviD

@RоryMcCune with a name like that?? Clearly he is Ukrainian. ;-)

Rоry McCune

@AviD ah the JIRA talk is from Dinis.. that'll be a case of name recognition

AviD

@RоryMcCune exactly

but that is not a security talk, let alone an OWASP talk.

a few of those talks I've already heard... the 2 Israelis already gave their talks at AppSecIL15 ;-)

also I really hate with a passion talks along the lines of "state of the industry"

Rоry McCune

some of them sound quite interesting, but yeah some ... less so

Matthew

I've been reading the new version of snoopers charter, and now I'm depressed

AviD

10:38

a lot of repetition, too

some look really interesting though

Rоry McCune

@AviD yeah I guess an artifact of how they did the scoring, if I was them I would've tried to reduce that a bit...

@AviD also I see they have the usual stellar gender balance...

AviD

hard to tell with some of those names, but yeah assumed...

Rоry McCune

@AviD the embarrassing thing is when they run "women in infosec" panels at these events along-side a programme line-up with like 1 or 2 women out of 40 speakers

AviD

@RоryMcCune or when that panel is mostly male

Rоry McCune

@AviD the thing is, I've seen it done right at tech. conf's so I know it can be done, they just don't put any effort in at all

@AviD for the ultimate irony

kalina

10:40

@TildalWave you're such a suck up

Matthew

Do any security conferences do discount entry for under-represented groups?

AviD

@RоryMcCune thats already beyond irony

@RоryMcCune I will say that it is not necessarily easy. but yeah.

Rоry McCune

@Matthew I've not seen that, you sometimes get cheap student tickets but that's about it

AviD

so at last appsecil we had 2 female speakers, out of 17 I think.

Rоry McCune

@AviD no not easy but definitely possible, and I just don't see the OWASP conf's trying despite the rhetoric

Matthew

10:41

I've seen sci-fi cons doing that to try and get more minority groups to feel welcome

AviD

was supposed to be another, but she dropped out.

M'vy

Hum... I can't say "a wild pony appears" anymore it seems.

Rоry McCune

@AviD well you had more in 17 speakers than I think AppSecEU has in theirs....

AviD

and I actually tried - and not random women "cuz female", but there are a few very good female speakers here.

kalina

@M'vy nope

AviD

10:42

3 mins ago, by AviD

hard to tell with some of those names, but yeah assumed...

Rоry McCune

@kalina I'm guessing from the look that your avatar is a anime char. of some kind...

M'vy

@kalina and replacing by angel/anime character does not carry the same impact. So ...

AviD

Marisa is the only one I know of, any I missed?

Rоry McCune

@AviD that's the only one I could see, as you say could be one or two more with the names listed, but I think it's only one.

AviD

shocking.

Rоry McCune

10:44

@AviD well it is for an org. that says that it's important to them to address this

M'vy

Michele ?

Rоry McCune

if an co. wants to run a conf. and makes no claims, that's just fine, but if they're going to have this as a goal they need to take action...

AviD

also - how can FIVE people give a talk on XSS??

@M'vy questionable, but I doubt it.

unless spelling is different.

M'vy

Simone

Rоry McCune

@M'vy well we've got a michele and he's a guy, so I think that one will be too...

AviD

10:45

@M'vy Thats a guy.

@M'vy for a girl woudl be spelled Michelle.

M'vy

@AviD Really?

Rоry McCune

@M'vy yeah

M'vy

@AviD Yeah I guess. The masculine in French is Michel

Matthew

@M'vy miki.it/about

kalina

@RоryMcCune I actually don't know, I saw pink angel in super innocent pose and it reminded me of myself

AviD

10:45

kalina

@M'vy a fallen angel appears?

AviD

@M'vy hmm. so it could go either way.

kalina

and then disappears again

o/

AviD

yeah Michele is a guy

Rоry McCune

@kalina \o

AviD

10:47

Michele Spagnuolo

@mikispag, Zürich

Information Security Engineer at Google. Wrote BitIodine. Broke the Internet with Rosetta Flash. Opinions are my own, unless hacked. In that case, hacker's.

2.7k tweets, 4.2k followers, following 670 users

M'vy

Maybe it's italian name

AviD

swiss

I also know Andreas is a guy.

Rоry McCune

@M'vy the guy we've got with that name is Italian

M'vy

Swiss is German/French and Italian

Matthew

Rohini Sulatycki is female

Rоry McCune

10:48

well that's them up to two, at least

Matthew

I think that's it though

M'vy

@kalina angels tend to do that yeah

Matthew

Which is a terrible ratio

AviD

@Matthew how do you know?

ah yeah

Rоry McCune

2/67

AviD

10:49

OWASP FROC 2010: Beware of Serialized GUI Objects Bearing Data 1/5

►

M'vy

@Matthew We start with a terrible ratio too. Women in IT accounts for what 20% max?

AviD

@RоryMcCune 67 speakers???

M'vy

@AviD read as, Beware of [...] Bear[...]

Rоry McCune

@AviD yeah they have loads of talks down with multiple speakers (IMHO it's rarely beneficial to have more than one speaker per talk)

AviD

@RоryMcCune sometimes 2, if they have good chemistry

can be awesome.

but FIVE?? for a talk like XSS??

ridiculous.

M'vy

10:51

A new user appears. Hi

Zachiel

Yeah, Michele in italian would be your Michael, while your Michele/Michelle would be Michela (or rarely Micaela) in Italian.
Same with Simon->Simone and Simone->Simona or Andrew->Andrea and Andrea->Andreina

Lighty

@M'vy Fresh meat? where

Zachiel

Hello!

Rоry McCune

hi

AviD

@RоryMcCune 68, actually. unless there are duplicates.

Zachiel

10:52

I think he's talking about me but I've already made my appearance here last month I think

Oh. Well, too much egocentrism

AviD

@Zachiel thats it, we start calling @Simon Simone.

Matthew

@AviD Linkedin, then reading the recommendations she's selected

M'vy

@AviD I was just thinkin of that

Or @Somone ?

AviD

hey @RоryMcCune - maybe next conf you and I get together to give a duo talk?

Rоry McCune

@AviD heh yeah could work, we'd need to get a good topic

also seems to up chances of getting accepted if that talk list is anything to go by

Zachiel

10:55

Isn't there a button to go to the main site from the chat?

M'vy

yes

Matthew

@RоryMcCune Running FOCA in Docker - whilst playing Soccer

M'vy

Bottom right

Ixrec

@Zachiel the logo in the bottom right

M'vy

Logo

Zachiel

10:55

Oooh thanks

AviD

@RоryMcCune yeah - didja catch the one that listed himself 3 times?

Rоry McCune

@Matthew fear the docker foca!

@AviD yeah that was the dude with the SecDevOps talk, that was an odd thing to have done...

AviD

@Matthew no no, 4GL in Docker

@RоryMcCune hey it got him in!

Rоry McCune

@AviD good call

Matthew

@AviD It doesn't rhyme! Would never make the lists!

AviD

10:57

I will say that most talks I've seen with multiple speakers - cop-out at best, gets in the way at worst. Usually they just take turns talking about a different part. pointless, just an excuse to get more heads in.

as opposed to one where the duo adds value - e.g. bouncing off each other, building on each other...

kalina

who wouldnt want to get more head in

as for bouncing off each other...

or building on each other for that matter.

Rоry McCune

#Euphemisms-Everywhere

Transcript for